CLOSEDQUORUM lets four AI models vote on malware actions

On 25 September 2026, Cisco Talos reported CLOSEDQUORUM, a Windows malware implant that asks up to four commercial large language models to select its next action, tallies their answers and executes the winning choice. Talos describes it as the first publicly documented Windows implant, to its knowledge, to use a panel of commercial models for tactical command and control. The researchers discovered the sample through CAIRN, an open-source toolkit released by Talos to track AI-integrated malware.

The finding is notable less for a novel credential-stealing technique than for where the decision is made. Rather than wait for an operator to issue continuing commands through an attacker-controlled server, CLOSEDQUORUM is designed to send structured requests to AI providers. Its intended targets include Windows credentials, saved browser passwords and cryptocurrency wallets. Talos says the architecture delegates the dynamic operation to AI services after the malware is deployed.

A vote instead of a conventional C2 server

The binary can integrate with DeepSeek, Qwen, Mistral and Google Gemini. It queries active providers sequentially, collects their responses and applies plurality voting: the action selected by the most models wins. The process is called a closed quorum because no person is admitted to the decision process. The model panel is not an open-ended chatbot conversation; it is a narrowly constrained routing mechanism for malware capabilities.

Traditional command-and-control infrastructure generally requires an attacker to operate domains, IP addresses, protocols and listeners. Those assets can be identified, blocked or tracked. CLOSEDQUORUM instead uses endpoints operated by commercial AI providers, which also serve many legitimate applications. That does not make its activity invisible, but it changes the network pattern defenders must examine: the signal is a combination of AI-service traffic, malicious local behavior and data transfer rather than one dedicated C2 address.

Talos’s static analysis found a complete autonomous decision loop, including build-time injection of provider credentials. Yet the publicly distributed build contains placeholder API keys and a dummy Discord webhook. Researchers therefore did not observe the full architecture operating end to end from that sample. This is an important limitation: the report documents code and development artifacts, not a confirmed live deployment or a confirmed victim campaign.

Four choices, constrained output

At startup, the implant collects host information including the hostname, Windows version, architecture, CPU count and administrator status. It adds that context, along with a refreshed target-process value, to the prompts sent to the models. Each response must conform to a typed JSON schema and select a known decision. Outputs that do not match the expected format or do not map to a capability are discarded.

The available decisions are deliberately limited. The option called steal launches LSASS credential dumping, browser credential extraction and cryptocurrency-wallet collection together. Inject generates shellcode and can use process hollowing or APC-based early-bird injection, depending on the suggested exploit type. Persist calls a persistence function. Move exists in the decision vocabulary but has no capability handler in the distribution build, according to Talos.

• The implant can collect credentials from LSASS memory and saved passwords from Chrome, Edge and Firefox.
• Its wallet targets include the MetaMask browser extension, Exodus wallet data and Ethereum wallet paths.
• It can send the winning decision, model reasoning and execution fields to an operator-controlled Discord webhook.
• When all queried models fail, it falls back to a non-actionable consensus value, sleeps and retries.

Tie-breaking exposes a fixed preference

A four-member vote can end in a tie, and CLOSEDQUORUM has a deterministic answer. DeepSeek has priority, followed by Qwen, Mistral and Gemini. Talos attributes this result to the order in which results are processed and a strict comparison in the code, rather than to a separate arbitration mechanism. If DeepSeek is unavailable, the next available provider in that ordering can gain the equivalent advantage. The design improves resilience against a refusal, timeout or malformed response, but does not guarantee a usable decision.

The malware preserves a model’s reasoning field and reports it with details such as the selected action, target process, evasion method, payload configuration, model and timestamp. Stolen material is sent to Discord as AES-256-GCM-encrypted base64 code blocks. SecurityAffairs, summarising the Talos report, noted that the encryption key is derived from the current date rather than a secret; that assessment concerns the reported implementation and should not be treated as evidence that every related build uses identical encryption.

Evidence of development, not confirmed deployment

Talos says artifacts in the binary were used to connect the developer to criminal-forum posts related to carding dating to 2025. The firm does not identify the individual in the supplied report, and it explicitly says it has no confirmation that CLOSEDQUORUM has been deployed in the wild. The available evidence therefore supports concern about a malware development effort and its apparent criminal-forum links, but not a conclusion about the scale, targets or success of any operation.

For defenders, the practical value of the case is in the correlated indicators. Talos highlights repeated execution at randomised intervals of roughly five to 15 minutes; API traffic from an unexpected Windows executable to several AI providers; closely timed, similar requests; and Discord webhook activity from the same process or host. Prompt contents may only be visible with TLS inspection or provider-side telemetry. Separately, access to LSASS, persistence creation and suspicious process injection remain familiar warning signs.

For organisations in English-speaking markets where AI APIs and Discord are commonplace business tools, blocking either service wholesale is unlikely to be a proportionate response. A more useful approach is to inventory approved AI-enabled applications, alert on unusual combinations of outbound AI-provider and Discord traffic, and connect those signals to endpoint activity. CLOSEDQUORUM is an early, incomplete public example, but it illustrates Talos’s central concern: AI may shift attacker effort from continuous human steering to automated decision loops that still leave operational traces.